For AI agents: the complete documentation index is available at https://jig.md/llms.txt, the full documentation bundle is available at https://jig.md/llms-full.txt, and this page is available as Markdown at https://jig.md/spec/grants.md.
jig
DocumentationSpecificationPrerelease

#Grants: power through ordinary slots

View Markdown

Status: prerelease implementation candidate.

A grant describes a resource and its permitted operation. A Binding connects that policy to a Flow's declared invocation slot. Only explicit admission makes the connection executable; neither a name nor a file is an authority handle.

#Start inline

export default defineBinding({
  package: 'flows/report',
  slots: {
    reference: {
      kind: 'http', url: 'https://docs.example.org/reference', method: 'GET',
      bearerEnv: 'DOCUMENT_TOKEN', responseBytes: 65536,
    },
    tests: { kind: 'command', test: ['test/project.test.ts'] },
  },
})

Each slot must declare the exact supported contract for its grant kind: HTTP Request, Project Command, or Finite ACP. The call selects the slot, not another resource name inside its input. Flow and Binding selectors remain available in the same slots map.

The finite native grant is native: { kind: 'acp', client: 'codex' }, with claude and pi as the other qualified client choices. It grants one bounded ACP conversation, not arbitrary process I/O. The operator's captured native configuration supplies the executable and private authentication; an optional grant model overrides its model selection for this recipient. Review shows that selected runtime beside the exact recipient. The ordinary Agent package drives the dialogue and interprets the answer.

An optional maxTurns integer from 1 through 8 authorizes serial native prompts within that one invocation; omission permits one. Turns share the original deadline and aggregate resource bounds. Changing the allowance changes reviewed authority. It does not permit session restoration or additional native tools.

For the qualified Codex profile, retainSessions: true separately authorizes bounded native history retention and restoration. The caller must still request it explicitly; ordinary calls remain ephemeral. A saved reference is not a grant and cannot cross the exact admitted recipient/provider scope. The finite ACP contract owns limits, single-use claims and clean-close requirements.

Only these three resource kinds are supported. A grant is closed policy data, not a plugin, executable code, generic permission bag, or credentials object. Inline authoring validates inert value structure; trusted project linking also validates exact URLs, embedded schemas, contract compatibility and resource bounds.

#Reuse a named policy when useful

In jig.ts, optionally include grants: discover('./grants'). Then grants/documents.json can contain:

{
  "kind": "http",
  "url": "https://docs.example.org/reference",
  "method": "GET",
  "bearerEnv": "DOCUMENT_TOKEN",
  "responseBytes": 65536
}

A Binding uses slots: { reference: 'grant:documents' }. The filename supplies the reusable name; reference remains the consumer-local slot. Named and inline policies have identical meaning and validation. A grant name cannot be run as a CLI target.

Discovery selects immediate regular <LocalName>.json files, without recursion, symlinks or globs. Exact member arrays are also supported. A missing discovery directory is empty; a missing selected grant or exact file is an error. Duplicate names across roots fail. Capture permits at most 256 policies, 32 KiB per file and 1 MiB total. Files must be singly linked. Each Binding permits at most eight slots of each resource kind within its 256-slot bound. Multiple slots do not increase concurrent effect capacity, root reservations or deadlines.

Use a named policy for intentional reuse across Bindings or an independently managed policy responsibility. A simple ACP policy is inline by default; a grants directory is not mandatory. Edit the selected source policy to make a lasting client change. An edit never changes an admitted generation.

The explicit jig review --agent codex|claude|pi argument constructs a proposed effective client for every selected normalized ACP policy before qualification. It changes only client and leaves inline, named/shared and computed source unchanged. The candidate, lock, review and inspection retain the effective policy and argument origin. Cross-client changes with a model pin or incompatible native retention refuse the complete request, and a request with no selected ACP policy is inapplicable. Same-client selection preserves all fields and still qualifies. A later review starts from captured source and its own arguments, without a remembered client preference. Project policy owns exact construction and retained identity; the CLI contract owns failure guidance. Review never rewrites a grant or silently substitutes a provider.

#Review and admission

jig review shows changes to recipients and effective policies, including destinations, credential references and limits. Confirming that exact plan admits the complete project revision atomically. No Flow runs during admission.

Noninteractive --yes alone cannot admit new or changed resource delegations. After checking the displayed changes, trusted automation may use jig review --yes --allow-authority-changes. The trusted administration API likewise requires allowAuthorityChanges: true when applying such a plan.

Authority continuity is scoped to this project, Binding, selected package path, slot, exact required contract and normalized policy. Copying or renaming a Binding, replacing its package, or changing its policy requires authority approval. Any policy change is treated conservatively; Jig does not infer schema subsumption. Merely renaming a shared declaration with identical effective policy does not change its permissions. Source revisions at the same recipient still require exact code admission, but not a second resource opt-in when permissions are unchanged. Removing a delegation requires normal revision approval, not approval of additional authority.

Grant files and Bindings are editable proposals. Their contents are captured under the project's safe source boundary and resolved into the protected admission generation. Edits, discovery or guessed slot names cannot alter a running Flow's route table. A Flow has no project-administration access; it can call only its own admitted routes. Child Bindings use their own policies, not their parent's, and resource slots do not turn a leaf into a nested Flow graph.

An admitted generation continues to use its captured policy until replaced by another admission. Source edits are not live revocation. Cancel existing work to settle its owned effects; already accepted remote effects cannot be undone. The operator environment supplies secret bytes when the host command starts. Secrets never enter Binding values, lock files, admission records, Flow input or public review. Missing selected credentials prevent use of that resource; rotating secret bytes alone does not change public policy identity. ACP prerequisite qualification retains SDK per-target readiness, but any observed typed selected ACP prerequisite refusal stops CLI review before apply or unchanged success. Earlier admission remains intact. Arbitrary, integrity and cleanup failures retain their existing fatal semantics; bounded presentation cannot erase an authoritative refusal.

FLOW's interface remains run.call: grant storage, approval and enforcement are Jig responsibilities. This profile does not add arbitrary process grants, dynamic resource publication, Agent-session replacement, or grant inheritance.